Constructing and Verifying Cyber Physical Systems

Size: px

Start display at page:

Download "Constructing and Verifying Cyber Physical Systems"

Bernice Montgomery
6 years ago
Views:

1 Constructing and Verifying Cyber Physical Systems Mixed Criticality Scheduling and Real-Time Operating Systems Marcus Völp

2 Overview Introduction Mathematical Foundations (Differential Equations and Laplace Transformation) Control and Feedback Transfer Functions and State Space Models Poles, Zeros / PID Control Stability, Root Locust Method, Digital Control Mixed-Criticality Scheduling and Real-Time Operating Systems (RTOS) Coordinating Networked Cyber-Physical Systems Program Verification Differential Dynamic Logic and KeYmaera X Differential Invariants Math Physics Feedback Control RTOS CPS Verification Summer 2015 Constructing and Verifying Cyber Physical Systems - Marcus Völp 178

3 Overview Cyclic Executives Real-Time Operating Systems The Case for Virtualization Scheduling Theory 101 Real-Time Systems Correctness not only depends on computed values, but also on their timeliness. Mixed Criticality Summer 2015 Constructing and Verifying Cyber Physical Systems - Marcus Völp 179

4 Cyclic Executive int main(void) { } // initialization code while (true) { task1; wait_until(t 2 ); task2; wait_until(t 3 ); } actual execution time worst-case execution time t 2 t 3 frame cooperative scheduling: tasks finish voluntarily errors or bugs in one task may jeopardize the entire system Summer 2015 Constructing and Verifying Cyber Physical Systems - Marcus Völp 180

5 Example: Arduino Scheduler typedef void (*task_fn_t)(void); struct Task { task_fn_t function; uint16_t interval_ticks; uint16_t max_time_micros; }; Task _tasks[num_tasks]; /* Scheduler *=========== * run one tick; this will run as many scheduler tasks as we can in the specified time */ void AP_Scheduler::run(uint16_t time_available) { uint32_t run_started_usec = hal.scheduler->micros(); uint32_t now = run_started_usec; if (_task_time_allowed <= time_available) { // run it _task_time_started = now; task_fn_t func = (task_fn_t)pgm_read_pointer(&_tasks[i].function); current_task = i; func(); current_task = -1; // record the tick counter when we ran. This drives // when we next run the event _last_run[i] = _tick_counter; // work out how long the event actually took now = hal.scheduler->micros(); uint32_t time_taken = now - _task_time_started; for (uint8_t i=0; i<_num_tasks; i++) { uint16_t dt = _tick_counter - _last_run[i]; uint16_t interval_ticks = pgm_read_word(&_tasks[i].interval_ticks); if (dt >= interval_ticks) { // this task is due to run. Do we have enough time to run it? _task_time_allowed = pgm_read_word(&_tasks[i].max_time_micros); if (dt >= interval_ticks*2) { // we've slipped a whole run of this task! } } } } } if (time_taken > _task_time_allowed) { // the event overran! } if (time_taken >= time_available) { } time_available -= time_taken; Summer 2015 Constructing and Verifying Cyber Physical Systems - Marcus Völp 181

6 Preemptive Scheduling user mode t 2 t 3 kernel mode time scheduling overhead priority (minimal) interrelease time T i relative deadline D i Summer 2015 Constructing and Verifying Cyber Physical Systems - Marcus Völp 182 time

7 Real-Time Operating Systems Functionality Thread / Task / Process: Abstraction for execution (sometimes also for resources shared by thread) Scheduling: When to run which task and for how long? Mutexes / Semaphores: Protection of resource accesses Mutex: single thread may enter critical section Semaphore: initial count determines how much threads can enter (count > 0 => semaphore is free; count =< 0 => semaphore is blocked) Timers: Used internally for scheduling Timeouts (e.g., when accessing a device) Summer 2015 Constructing and Verifying Cyber Physical Systems - Marcus Völp 183

8 Microkernels Functionality Isolation Message passing to overcome isolation boundaries Address spaces App App App Cyclic Executive / some RTOSs Hardware App App App OS Server Driver Microkernel Hardware Inter Process Communication Summer 2015 Constructing and Verifying Cyber Physical Systems - Marcus Völp 184

9 Context Switches App App App App App App Cyclic Executive / some RTOSs Hardware OS Server Driver Microkernel Hardware while (true) { task1(); 1: wait_until(t 2 ); task2(); 2: wait_until(t 3 ); } call task1 = push 1f jmp task1 user kernel R Task 1 e Task 2 task 1 area g 1) find state save area of task 1 2) store user regs 3) find state save area for task 2 4) load user regs 5) switch address space 6) exit from kernel R e g task 2 area Summer 2015 Constructing and Verifying Cyber Physical Systems - Marcus Völp 185

10 Context Switches page / translation table base register page table: f(v) -> p App App App OS Server Driver Microkernel Hardware 0x1f3dc dab user kernel R Task 1 e Task 2 task 1 area g 1) find state save area of task 1 2) store user regs 3) find state save area for task 2 4) load user regs 5) switch address space 6) exit from kernel R e g task 2 area Summer 2015 Constructing and Verifying Cyber Physical Systems - Marcus Völp 186

11 Context Switches page / translation table base register page table: f(v) -> p App App App OS Server Driver Microkernel Hardware 0x1f3dc dab user kernel R Task 1 e Task 2 task 1 area g 1) find state save area of task 1 2) store user regs 3) find state save area for task 2 4) load user regs 5) switch address space 6) exit from kernel R e g task 2 area Summer 2015 Constructing and Verifying Cyber Physical Systems - Marcus Völp 187

12 The Case for Virtualization Extended functionality requires a certain amount of code more bugs (approx. 1 / 1000 LOC) less predictable timing complexity high-end CPUs to speed up mostly sequential execution but, complex applications are often less timing critical open issue: is this still true for vision, App OS Server App Microkernel App Driver Linux VMM App guest virtual machine monitor host Hardware Summer 2015 Constructing and Verifying Cyber Physical Systems - Marcus Völp 188

13 The Case for Virtualization Virtualization in a nutshell App App systemcall guest virtual guest host Linux VMM Microkernel guest physical VM call / VM exit host physical make sure every interesting event (access to registers of virtualized devices, page faults at transparently shared page, ) exit the VM prevent guest from unauthorized access to resources App App Linux App App VMM OS Server Driver Microkernel Hardware guest virtual machine monitor host Summer 2015 Constructing and Verifying Cyber Physical Systems - Marcus Völp 189

14 Scheduling Theory 101 Periodic Task Model: τ i = (C i, P i, D i ) Task characterized as sequence of jobs (possibly infinite) φ i P i D i Worst-Case Execution Time (WCET) C i upper bound on job execution times r i,0 C i r i,j C i Period P i subsequent jobs arrive exactly P i apart φ i P i D i relative Deadline D i implicit D i = P i constrained D i P i arbitrary (also D i > P i ) Phase φ i release time r i,j = jp i + φ i absolute deadline AD i,j = r i,j + D i r i,0 C i r i,j C i Sporadic Task Model: τ i = (C i, P i, D i ) Like periodic, exept: minimal interrelease time P i between the release of any two subsequent jobs, there is at least P i time. Summer 2015 Constructing and Verifying Cyber Physical Systems - Marcus Völp 190

15 Scheduling Theory 101 Scheduling Scheduling algorithm: decides when to run which job, where (on which resources, typically on which core), and for how long. Schedule is feasible for a set of tasks if: 1) no job τ i,j executes before r i,j 2) all jobs receive at least C i time in between r i,j and r i,j +D i Scheduling algorithm is optimal (wrt. schedulability) if it finds a feasible schedule whenever there exists one. φ i P i D i r i,0 C i r i,j C i φ i P i r i,0 C i r i,j C i D i (Classic) sporadic task model: A set of sporadic tasks is schedulable if it is schedulable at the synchronous arrival sequence, that is, when the first job of all tasks arrives at the same time and when subsequent jobs are exactly P i apart.!!! Does not hold for mixed-criticality tasks!!! Summer 2015 Constructing and Verifying Cyber Physical Systems - Marcus Völp 191

16 Scheduling Theory 101 Fixed Task Priority (Uniprocessor) assign priority to task and use the same priority for all jobs simultaneous release produces worst schedule critical instant e.g., Rate Monotonic Scheduling assign priorities inverse proportional to P i if phase = 0, D i = P i and jobs are independent (must not wait for others): optimal if periods are harmonic (integer multiples) optimal in the class of fixed task priority algorithms Liu Layland Criterion: n periodic tasks are schedulable with RMS if n i=1 Utilization C i P i n ( n 2 1) 0.69 n Summer 2015 Constructing and Verifying Cyber Physical Systems - Marcus Völp 192

17 Scheduling Theory 101 Fixed Job Priority (Uniprocessor) assign fixed priority to job (once it is released) don t change priorities of running jobs e.g., Earliest Deadline First job priority proportional to absolute deadline optimal if jobs are independent, phase = 0 n i=1 C i P i Optimal multiprocessor scheduling algorithms require jobs to change priorities and assigned processors (migrate) while they run. (trivial extensions of EDF partitioned / global EDF have utilization bound of m+1 2 ) Summer 2015 Constructing and Verifying Cyber Physical Systems - Marcus Völp 193

18 Why learn scheduling theory? Get an idea when and how your control tasks will be executed? Is your system strong enough to schedule all tasks or do you need additional processors? Understand choices and tradeoffs when selecting a system: cyclic executive time partitioned system (scheduling like cyclic ex. but with isolation) dynamic scheduling in RTOS / RT-Microkernel mutex locked by 3 while preempted will be unavailable to 2 (priority inversion) 2 runs in between here: may happen between two device register accesses preemption leaves task with cold caches must be considered when determining WCET Summer 2015 Constructing and Verifying Cyber Physical Systems - Marcus Völp 194

19 Mixed criticality scheduling Consolidate safety-critical tasks of different importance into a single system to share resources (most notably the CPU), even across criticality levels to safe costs, weight, energy C(LO) C(HI) Tasks: τ i = (l i, C i, P i, D i ), e.g., l i LO, HI Definition: (MC-feasibility) A set T of tasks is mixed-criticality feasible if every job τ i,j receives C i (l i ) time in between r i,j and r i,j + D i, provided the following rely condition holds: all jobs τ h,k of higher criticality tasks τ h (with l h > l i ) complete within C h (l i ) units time. Summer 2015 Constructing and Verifying Cyber Physical Systems - Marcus Völp 195

20 Mixed criticality scheduling Definition: (MC-feasibility) A set T of tasks is mixed-criticality feasible if every job τ i,j receives C i (l i ) time in between r i,j and r i,j + D i, provided the following rely condition holds: all jobs τ h,k of higher criticality tasks τ h (with l h > l i ) complete within C h (l i ) units time. C(LO) C(HI) HI LO Summer 2015 Constructing and Verifying Cyber Physical Systems - Marcus Völp 196

21 Mixed criticality scheduling Definition: (MC-feasibility) A set T of tasks is mixed-criticality feasible if every job τ i,j receives C i (l i ) time in between r i,j and r i,j + D i, provided the following rely condition holds: all jobs τ h,k of higher criticality tasks τ h (with l h > l i ) complete within C h (l i ) units time. C(LO) C(HI) HI LO Summer 2015 Constructing and Verifying Cyber Physical Systems - Marcus Völp 197

22 Mixed criticality scheduling Criticality Monotonic Scheduling Higher criticality tasks are higher prioritized than all lower criticality tasks. Use classical algorithm within criticality band (e.g., RMS) HI LO Summer 2015 Constructing and Verifying Cyber Physical Systems - Marcus Völp 198

23 Mixed criticality scheduling Criticality Monotonic Scheduling Higher criticality tasks are higher prioritized than all lower criticality tasks. Use classical algorithm within criticality band (e.g., RMS) HI LO Summer 2015 Constructing and Verifying Cyber Physical Systems - Marcus Völp 199

24 Mixed criticality scheduling Criticality Monotonic Scheduling Higher criticality tasks are higher prioritized than all lower criticality tasks. Use classical algorithm within criticality band (e.g., RMS) HI LO criticality inversion lower criticality job executes at higher priority than high criticality job to guarantee its completion in case the rely condition holds. Summer 2015 Constructing and Verifying Cyber Physical Systems - Marcus Völp 200

Examples Sacrificing tasks for more critical

Catastrophic IEC EN 61508: Safety Certification

operation) B: Hazardous SIL 4: 10-8 10-9 PFH C:

Entertainment D: E: Minor No Safety Effect SIL 2:

25 Examples Sacrificing tasks for more critical functionality Source: NASA Source: Magnus Manske (CC-BY 2.0) Flight Drive / Break A: DO 178c Certification Catastrophic IEC EN 61508: Safety Certification Probability for Faults per Hour (continuous operation) B: Hazardous SIL 4: PFH C: Major SIL 3: PFH Image Processing Car Entertainment D: E: Minor No Safety Effect SIL 2: PFH SIL 1: PFH Summer 2015 Constructing and Verifying Cyber Physical Systems - Marcus Völp 201

26 Examples: Autonomous Driving Lane Driving Vehicle Driver Transition Manager Intersection Handling Panhead Planner Distance Keeper Current Scene Reporter Merge Planner Lane Selector Precedence Estimator Goal Selector State Estimator Goal Selection Urmson et al., 2008, Autonomous driving in urban environments: Boss and the Urban Challenge Summer 2015 Constructing and Verifying Cyber Physical Systems - Marcus Völp 202

27 Design for Mixed Criticality Bounded interference in independent development slack How to limit the interference a low task may cause without having to rely on an analysis of this task? How to limit cross core interference in such a way? Summer 2015 Constructing and Verifying Cyber Physical Systems - Marcus Völp 203

28 Design for Mixed Criticality Catchup / Restart after dropping If the new job proceeds with fresh data anyway, prepare to discharge intermediate results of the previous job. Summer 2015 Constructing and Verifying Cyber Physical Systems - Marcus Völp 204

29 Overview Cyclic Executives Real-Time Operating Systems The Case for Virtualization Scheduling Theory 101 Real-Time Systems Correctness not only depends on computed values, but also on their timeliness. Mixed Criticality Summer 2015 Constructing and Verifying Cyber Physical Systems - Marcus Völp 205

30 The Big Picture Control Control Control Computer Summer 2015 Constructing and Verifying Cyber Physical Systems - Marcus Völp 206

31 The Big Picture Control Control Control Computer Summer 2015 Constructing and Verifying Cyber Physical Systems - Marcus Völp 207

32 Overview Introduction Mathematical Foundations (Differential Equations and Laplace Transformation) Control and Feedback Transfer Functions and State Space Models Poles, Zeros / PID Control Stability, Root Locust Method, Digital Control Mixed-Criticality Scheduling and Real-Time Operating Systems (RTOS) Coordinating Networked Cyber-Physical Systems Program Verification Differential Dynamic Logic and KeYmaera X Differential Invariants Math Physics Feedback Control RTOS CPS Verification Summer 2015 Constructing and Verifying Cyber Physical Systems - Marcus Völp 208

Introduction to Embedded Systems

Introduction to Embedded Systems Sanjit A. Seshia UC Berkeley EECS 9/9A Fall 0 008-0: E. A. Lee, A. L. Sangiovanni-Vincentelli, S. A. Seshia. All rights reserved. Chapter : Operating Systems, Microkernels,